The npm ecosystem of JavaScript libraries is more interwoven than most developers think, and the entire thing is a gigantic house of cards, being one bad hack away from compromising hundreds of thousands of projects, according to a recent academic study. From a report: The research, carried out by the Department of Computer Science from the Technical University of Darmstadt, in Germany, analyzed the dependency graph of the entire npm ecosystem. Researchers downloaded metadata for all the npm packages published until April 2018 and created a giant graph that included 676,539 nodes and 4,543,473 edges (lines connecting the nodes). In addition, academics also analyzed different versions of the same packages, looking at historical versions (5,386,239 versions for the 676,539 packages), but also at the package maintainers (199,327 npm accounts), and known security flaws impacting the packages (609 public reports). […]
Their goal was to get an idea of how hacking one or more npm maintainer accounts, or how vulnerabilities in one or more packages, reverberated across the npm ecosystem; along with the critical mass needed to cause security incidents inside tens of thousands of npm projects at a time. […] But while some npm packages load code from too many packages and from too many developers, there is another dangerous trend forming on the npm package repository — namely the consolidation of popular npm packages under a few maintainer accounts. “391 highly influential maintainers affect more than 10,000 packages, making them prime targets for attacks,” the research team said. “If an attacker manages to compromise the account of any of the 391 most influential maintainers, the community will experience a serious security incident.”
of this story at Slashdot.
Source:: Slashdot